CVE-2019-3878

Public on 2019-05-02
Modified on 2019-05-20
Description
A vulnerability was found in mod_auth_mellon. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
Severity
Important
CVSS v3 Base Score
8.1
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 2 mod_auth_mellon 2019-05-16 21:50 ALAS2-2019-1200
Amazon Linux 1 mod24_auth_mellon 2019-05-02 17:18 ALAS-2019-1200

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD CVSSv2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
NVD CVSSv3 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H